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The Examiner has rejected Claims 1-6, 8, 10-17, 19, 21-28, 30, 32-39, 41, 43-50, 52, 54-61, 63, 
65-66, and 72-74 under 35 U.S.C. 103(a) as being unpatentable over "Symantec System Center 
Implementation Guide" (hereinafter "Symantec") in view of Chen et al. (U.S. Patent 5,960,170) in view 
of Brown ("Data Communications") and further in view of Graham ("URLs for HTTP Servers"). 
Applicant respectfully disagrees with such rejection. 



With respect to the independent claims, the Examiner has relied on section 8.1.1 in Graham to 
make a prior art showing of applicant's claimed technique "wherein said data retrieving logic and said 
report sending logic use an internet URL to specify said requested data to said receiving computer, said 
internet URL also containing said report data to be sent to said receiving computer" (see this or similar, 
but not necessarily identical language in the independent claims). 

Applicant respectfully asserts that such excerpt only teaches a URL that includes (1) the 
directory to a program/script and (2) the search parameters for the program/script to utilize when 
performing a search. Applicant emphasizes the URL example shown in section 8.1.1 as follows: 
http://some.site.edu/cgi-bin/foo7arRl +arg2+arg3 . As shown in Graham, such URL only contains the 
directory (i.e. http://some.site.edu/cgi-bin/foo) and the parameters (i.e. argl+arg2+arg3). Applicant, on 
the other hand, claims that the "internet URL also contain[s] said report data to be sent to said receiving 
computer" (emphasis added). Clearly, Graham's disclosed directory and parameters do not meet 
applicant's claimed report data, especially when read in context, namely that the "report data 
identifies] said reporting computer and said event " (see the independent claims). Furthermore, 
Graham's disclosed directory and parameters also do not meet applicant's claimed "internet 
URL... [that] specifies] said requested data" (emphasis added). 

In the Office Action mailed 04/1 1/2006, the Examiner argued that "Graham is relied upon to 
show that a URL [m]a[y] send data and this data is what is defined as the requested data in the 
combination of Symantec and Chen et al." In response, applicant respectfully asserts that the 
combination of Symantec, Chen, Graham et al. fails to disclose applicant's claimed "sending said 
report data from said reporting computer to said receiving computer during fetching of said requested 
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data," "wherein an internet URL is used to specify said requested data to said receiving computer, said 
internet URL specifying said requested data also containing said report data to be sent to said receiving 
computer." 

Specifically, the Examiner relied upon Col. 7, lines 33-45 in Chen to make a prior art showing 
of applicant's claimed "sending said report data from said reporting computer to said receiving 
computer during fetching of said requested data." Applicant respectfully asserts that Chen merely 
discloses that, "[a]fter receipt of the virus detection object, in step 220 the virus detection object is 
executed by the client 300 and in step 225 the results of virus detection object execution are transmitted 
to the virus detection server 400 which receives the results and in step 230 produces an additional virus 
detection based upon the result of the execution of the first virus detection object" (emphasis added). 
Clearly, Chen's disclosure that the additional virus detection object is produced based on the result of 
the execution (along with the disclosure of the remaining references) fails to even suggest " sending said 
report data from said reporting computer to said receiving computer during fetching of said requested 
data" (emphasis added), as claimed by applicant. Since Chen discloses sending the result, and then 
receiving the additional virus detection, Chen fails to even suggest applicant's claimed "sending said 
report data . . . during fetching of said requested data" (emphasis added), as claimed. 

In addition, it appears that the Examiner further relied upon page 2 in Brown to make a prior art 
showing of applicant's claimed "sending said report data . . . during fetching of said requested data." 
Applicant points out that page 2 of Brown discloses that, with Full Duplex, "[djata can travel in both 
directions simultaneously [and] [t]here is no need to switch from transmit to receive mode like in half 
duplex" (emphasis added). However, page 1 of Brown discloses that "you can think of Internet surfing 
as being half-duplex, as a user issues a request for a web document , then that document is downloaded 
and displayed before the user issues another request " (emphasis added). Clearly, Brown's disclosure 
of Internet requests for a web document being half-duplex fails to meet and even teaches away from 
using a full-duplex transmit and receive mode for applicant's claimed "sending said report data . . . 
during fetching of said requested data" (emphasis added). 

To this end, even when the Examiner's proposed combination is taken into account in its 
entirety, the claimed invention is still not met. 
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Even still, the Examiner relied upon section 8.1.1 in Graham to make a prior art showing of 
applicant's claimed technique "wherein an internet URL is used to specify said requested data to said 
receiving computer, said internet URL specifying said requested data also containing said report data to 
be sent to said receiving computer." Applicant respectfully asserts that Graham merely discloses that 
"[t]he HTTP protocol supports] the passing of arguments to the server" where "[t]he general format is 
to postpend the arguments to the URL, separated from the URL by a question mark (?)." However, 
merely passing arguments to the server by postpending the arguments to the URL (along with the 
disclosure of the remaining references) fails to even suggest a technique "wherein an internet URL is 
used to specify said requested data to said receiving computer, said internet URL specifying said 
requested data also containing said report data to be sent to said receiving computer." Clearly, the mere 
disclosure that "these programs/scripts can in turn act on the arguments and return information , 
documents, etc. to the browser" (emphasis added - along with the disclosure of the remaining 
references) fails to even suggest that " said requested data also contain[s] said report data " (emphasis 
added), as claimed by applicant. Again, when the Examiner's proposed combination is taken into 
account in its entirety, the claimed invention is still not met. 

Applicant further notes that the prior art is also deficient with respect to the dependent claims. 
Just by way of example, with respect to Claim 4 et al., the Examiner has relied on pages 13 and 18 in 
Symantec to make a prior art showing of applicant's claimed technique "wherein said requested data is 
a description of said event." Applicant respectfully asserts that such excerpts from Symantec only 
teach that the Symantec System Center provides alerting, logging and data export and activating tasks, 
and that virus update files and product updates can be retrieved from a master primary server. Clearly, 
such teachings do not even suggest a " description of said event," as claimed (emphasis added). 

In the Office Action mailed 04/1 1/2006, the Examiner argued that "the alert described on pages 
13, 18, and 73 of Symantec clearly describe an event, by showing when, where, and what happened." 
Applicant respectfully asserts that page 73 of Symantec merely discloses an "Alert Log [which] 
displays a list of alerts with information about each alert: Alert Name, Source, Computer, Date, Time, 
Severity." However, merely listing information about the alert fails to even suggest a technique 
"wherein said requested data is a description of said event " (emphasis added), as claimed by applicant. 
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With respect to Claim 5 et al., the Examiner has relied on pages 18 and 73 in Symantec to make 
a prior art showing of applicant's claimed technique "wherein said event is detection of a computer file 
containing a computer virus and said requested data is a description of said computer virus." First, 
applicant respectfully asserts that Symantec does not teach a description of a computer virus, as 
claimed by applicant, for the reasons noted above with respect to Claim 4 et al. Second, it seems the 
Examiner has attempted to show that Symantec discloses a detection of a computer virus and that 
Symantec provides a description of a computer virus without taking into account the context of 
applicant's claim language. In particular, applicant claims that "said event is detection of a computer 
file containing a computer virus and said requested data is a description of said computer virus" where, 
for example, said event is identified in a report and said requested data is fetched "from a receiving 
computer" (see the independent claims for context-emphasis added). 

With respect to Claim 6 et al., the Examiner has again relied on pages 18 and 73 in Symantec to 
make a prior art showing of applicant's claimed technique "wherein said event is detection of a 
computer file containing a computer virus and said requested data is an updated set of computer virus 
detecting data for use in detecting computer viruses." For substantially the same reasons as argued 
above with respect to Claim 5 et al., applicant respectfully asserts that Symantec fails to teach 
applicant's specific claim language when read in context . 

In the Office Action mailed 04/1 1/2006, the Examiner argued that "Symantec is relied upon for 
its teaching of the report data with the report data describing an event, by showing when, where, and 
what happened and Chen et al teaches sending the requested report data." Applicant respectfully asserts 
that Col. 7, lines 33-45 of Chen merely discloses that "results of virus detection object execution are 
transmitted to the virus detection server 400 which receives the results and in step 230 produces an 
additional virus detection based upon the result of the execution of the first virus detection object" 
(emphasis added). Clearly, the mere disclosure that the virus detection server produces an additional 
virus detection based upon the result fails to even suggest that "said requested data is a description of 
said computer virus" (see Claim 5 et al. - emphasis added) and that "said requested data is an updated 
set of computer virus detecting data for use in detecting computer viruses" (see Claim 6 et al. - 
emphasis added), as claimed by applicant. 
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With respect to Claim 8 et al., the Examiner has relied on the Figure on page 73 of Symantec to 
make a prior art showing of applicant's claimed technique "wherein said reporting computer collates 
report data specifying one or more events that is sent together from said reporting computer to said 
receiving computer during said fetch of said requested data." Applicant respectfully asserts that such 
figure only shows a list of alerts. Clearly, a list of alerts that each show the type of event discovered 
and the computer from which said event occurred does not meet all of applicant's claim language, 
namely that "said reporting computer collates report data specifying one or more events that is sent 
together from said reporting computer to said receiving computer during said fetch of said requested 
data" (emphasis added). In fact, applicant notes that the log shown on page 73 of Symantec is 
associated with a specific server and that a copy is merely displayed when requested by a local console, 
but not that collated report data "is sent. ..during said fetch of said requested data," as claimed by 
applicant. 

In the Office Action mailed 04/1 1/2006, the Examiner argued that "Symantec teaches 
generating a list of all alerts generated by the network computers" and that "[i]n combination these 
alerts were collected during the fetch of the requested data as taught by Chen et al." However, 
applicant respectfully asserts that Col. 7, lines 33-45 in Chen merely discloses that the "virus detection 
object is executed by the client 300 and in step 225 the results of virus detection object execution are 
transmitted to the virus detection server" (emphasis added). Clearly, transmitting results of the virus 
detection object execution fails to even suggest that "said reporting computer collates report data 
specifying one or more events that is sent together from said reporting computer to said receiving 
computer during said fetch of said requested data" (emphasis added), as claimed by applicant. In 
addition, Symantec teaches that "[e]ach server stores its own copy of the Alert Log locally" and that 
"[w]hen you select a server an[d] view its alert log, you're actually retrieving a copy of that server's 
Alert Log to your local console" (emphasis added). Clearly, disclosing the server has a copy which is 
retrieved to the local console upon viewing, fails to even suggest that " said reporting computer collates 
report data specifying one or more events that is sent together from said reporting computer to said 
receiving computer during said fetch of said requested data " (emphasis added), as claimed by 
applicant. 



